config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 (((action_file_name in ("/etc/cron.d/*", "/etc/cron.daily/*", "/etc/cron.hourly/*", "/etc/cron.monthly/*", "/etc/cron.weekly/*", "/var/spool/cron/crontabs/*", "/var/spool/cron/root*")) or 
 (action_file_name in ("*/etc/cron.allow*", "*/etc/cron.deny*", "*/etc/crontab*"))) and 
 (not 
 (action_file_name in ("/etc/cron.daily/apt", "/etc/cron.daily/dpkg", "/etc/cron.daily/passwd", "/etc/crontabs/root")))))